In the operation and maintenance control of a web application for providing services to users through the Internet, performance measurements are carried out to monitor delay in processing executed in response to requests from users. For example, a series of processes executed in response to a processing request from a user is considered as a transaction, and the content of the transaction is analyzed. In the transaction analysis, for example, a Hypertext Transfer Protocol (HTTP) request-response process, from handling a first request up to returning a response to the user, and a database access process having taken place in the transaction are detected. Then, the detected processes are analyzed to thereby calculate the time taken for each of the processes.
In a transaction analytical method, messages moving over a network are intercepted by packet capture, logging, or the like. Among the intercepted messages, messages transmitted and received in the same transaction are associated with each other. Based on the group of the associated messages, the processing content of the transaction is analyzed. To associate messages, time information added to the messages, for example, is used. When information of a message is recorded, it is usually the case that time information is added thereto besides the message body. By determining the temporal relationship among events based on the time information of messages, it is possible to find a group of messages exchanged in the same transaction.
In the case where transaction analysis is performed using the time information of messages acquired by packet capture or logging, accurate synchronization of time between apparatuses used for obtaining messages has a beneficial effect on improving analysis accuracy. However, programs and apparatuses recording information, such as messages, independently measure the progress of time, and time differences usually exist among them. Because such apparatuses add time information to acquired messages based on their internal clocks, time differences also appear in the added time information. Time asynchronism in the time information of the messages results in inaccurate determination of the temporal relationship among the messages. This produces errors in determining which messages belong to the same transaction when the determination is made based on the time information of the messages.
The Network Time Protocol (NTP) has been conventionally used for clock synchronization between servers. Note however that the NTP application often fails to provide accurate synchronization sufficient to associate messages with each other. Furthermore, in the case where a single apparatus uses a plurality of different processes to obtain message information, the same effect as when there are time differences between apparatuses may be produced for the same original time information because the timing of adding a time stamp to a message is different among the processes.
Note that there is a technique for synchronizing the time of a server to another server in a remote location using a global positioning system (GPS), which however needs special hardware and thus leads to an increase in cost. Even if time synchronization is achieved by a GPS, the problem of time asynchronism due to differences in timing of adding a time stamp among processes still remains and is thus not solved simply by synchronizing time information between apparatuses.
Thus, inconsistency in time information of logs recorded by a plurality of different apparatuses may prevent accurate analysis. In view of this, a technique has been proposed to correct time stamps recorded in a plurality of logs output from a plurality of computers according to a time correction log and a consistency rule among the plurality of logs.    Japanese Laid-open Patent Publication No. 2006-11683    Japanese Laid-open Patent Publication No. 2008-269084
However, the conventional time correction method does not clearly determine the temporal range of information to which an obtained time correction value is applicable for correcting time information, and may therefore fail to use an appropriate correction value in the correction procedure. For example, when time difference per unit time varies, it may not be possible to find a common single correction value applicable to information over an excessively large temporal extent whilst maintaining temporal consistency among all the information in the temporal extent. Thus, if the application range of the obtained time correction value is inaccurate, the correction value is no longer appropriate, failing to achieve proper time correction.